{"schema_version":"2","view":"grouped","data":[{"id":19478,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js Security Releases","summary":"Node.js security updates address multiple vulnerabilities across the 20.x, 22.x, 24.x, and 25.x release lines. The announcement lists fixes for denial of service, permission model bypasses, crashes, and other issues.","evidence":"Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v20.20.2"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v20.20.2","evidence":"Node.js v20.20.2"},{"value":"Node.js v22.22.2","evidence":"Node.js v22.22.2"},{"value":"Node.js v24.14.1","evidence":"Node.js v24.14.1"},{"value":"Node.js v25.8.2","evidence":"Node.js v25.8.2"}],"affected_versions":[{"value":"20.x","evidence":"The 20.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"22.x","evidence":"The 22.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"24.x","evidence":"The 24.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"25.x","evidence":"The 25.x release line of Node.js is vulnerable to 2 high severity issues, 5 medium severity issues, 2 low severity issues."}]}],"severity":"high","related_cves":[{"value":"CVE-2026-21637","evidence":"Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS (CVE-2026-21637)"},{"value":"CVE-2026-21710","evidence":"Denial of Service via __proto__ header name in req.headersDistinct (Uncaught TypeError crashes Node.js process) (CVE-2026-21710)"},{"value":"CVE-2026-21711","evidence":"Node.js Permission Model bypass: UDS server bind/listen works without --allow-net (CVE-2026-21711)"},{"value":"CVE-2026-21712","evidence":"Assertion error in node_url.cc via malformed URL format leads to Node.js crash (CVE-2026-21712)"},{"value":"CVE-2026-21713","evidence":"Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery (CVE-2026-21713)"},{"value":"CVE-2026-21714","evidence":"Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion (CVE-2026-21714)"},{"value":"CVE-2026-21717","evidence":"HashDoS in V8 (CVE-2026-21717)"},{"value":"CVE-2026-21715","evidence":"Permission Model Bypass in realpathSync.native Allows File Existence Disclosure (CVE-2026-21715)"},{"value":"CVE-2026-21716","evidence":"CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown (CVE-2026-21716)"}],"security_relevant":true,"severity_evidence":"2 high severity issues."},"group_id":"advisory:ed18e8b9-148d-46af-aa8f-16ccebeea63a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","advisory_id":"ed18e8b9-148d-46af-aa8f-16ccebeea63a","event_types":["patch"],"published_at":"2026-10-25T03:57:28.996522+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T03:00:00+00:00","detail_url":"/advisories/advisory%3Aed18e8b9-148d-46af-aa8f-16ccebeea63a","group":{"id":"advisory:ed18e8b9-148d-46af-aa8f-16ccebeea63a","revision":1,"primary_event_id":19342,"change":"published","superseded_by":[],"changed":{"id":19342,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js Security Releases","summary":"Node.js security updates address multiple vulnerabilities across the 20.x, 22.x, 24.x, and 25.x release lines. The announcement lists fixes for denial of service, permission model bypasses, crashes, and other issues.","evidence":"Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v20.20.2"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v20.20.2","evidence":"Node.js v20.20.2"},{"value":"Node.js v22.22.2","evidence":"Node.js v22.22.2"},{"value":"Node.js v24.14.1","evidence":"Node.js v24.14.1"},{"value":"Node.js v25.8.2","evidence":"Node.js v25.8.2"}],"affected_versions":[{"value":"20.x","evidence":"The 20.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"22.x","evidence":"The 22.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"24.x","evidence":"The 24.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"25.x","evidence":"The 25.x release line of Node.js is vulnerable to 2 high severity issues, 5 medium severity issues, 2 low severity issues."}]}],"severity":"high","related_cves":[{"value":"CVE-2026-21637","evidence":"Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS (CVE-2026-21637)"},{"value":"CVE-2026-21710","evidence":"Denial of Service via __proto__ header name in req.headersDistinct (Uncaught TypeError crashes Node.js process) (CVE-2026-21710)"},{"value":"CVE-2026-21711","evidence":"Node.js Permission Model bypass: UDS server bind/listen works without --allow-net (CVE-2026-21711)"},{"value":"CVE-2026-21712","evidence":"Assertion error in node_url.cc via malformed URL format leads to Node.js crash (CVE-2026-21712)"},{"value":"CVE-2026-21713","evidence":"Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery (CVE-2026-21713)"},{"value":"CVE-2026-21714","evidence":"Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion (CVE-2026-21714)"},{"value":"CVE-2026-21717","evidence":"HashDoS in V8 (CVE-2026-21717)"},{"value":"CVE-2026-21715","evidence":"Permission Model Bypass in realpathSync.native Allows File Existence Disclosure (CVE-2026-21715)"},{"value":"CVE-2026-21716","evidence":"CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown (CVE-2026-21716)"}],"security_relevant":true,"severity_evidence":"2 high severity issues."},"group_id":"advisory:ed18e8b9-148d-46af-aa8f-16ccebeea63a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","advisory_id":"ed18e8b9-148d-46af-aa8f-16ccebeea63a","event_types":["patch"],"published_at":"2026-10-25T03:57:28.996522+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T03:00:00+00:00","detail_url":"/events/19342"},"members":[{"id":19342,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js Security Releases","summary":"Node.js security updates address multiple vulnerabilities across the 20.x, 22.x, 24.x, and 25.x release lines. The announcement lists fixes for denial of service, permission model bypasses, crashes, and other issues.","evidence":"Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v20.20.2"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v20.20.2","evidence":"Node.js v20.20.2"},{"value":"Node.js v22.22.2","evidence":"Node.js v22.22.2"},{"value":"Node.js v24.14.1","evidence":"Node.js v24.14.1"},{"value":"Node.js v25.8.2","evidence":"Node.js v25.8.2"}],"affected_versions":[{"value":"20.x","evidence":"The 20.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"22.x","evidence":"The 22.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"24.x","evidence":"The 24.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"25.x","evidence":"The 25.x release line of Node.js is vulnerable to 2 high severity issues, 5 medium severity issues, 2 low severity issues."}]}],"severity":"high","related_cves":[{"value":"CVE-2026-21637","evidence":"Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS (CVE-2026-21637)"},{"value":"CVE-2026-21710","evidence":"Denial of Service via __proto__ header name in req.headersDistinct (Uncaught TypeError crashes Node.js process) (CVE-2026-21710)"},{"value":"CVE-2026-21711","evidence":"Node.js Permission Model bypass: UDS server bind/listen works without --allow-net (CVE-2026-21711)"},{"value":"CVE-2026-21712","evidence":"Assertion error in node_url.cc via malformed URL format leads to Node.js crash (CVE-2026-21712)"},{"value":"CVE-2026-21713","evidence":"Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery (CVE-2026-21713)"},{"value":"CVE-2026-21714","evidence":"Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion (CVE-2026-21714)"},{"value":"CVE-2026-21717","evidence":"HashDoS in V8 (CVE-2026-21717)"},{"value":"CVE-2026-21715","evidence":"Permission Model Bypass in realpathSync.native Allows File Existence Disclosure (CVE-2026-21715)"},{"value":"CVE-2026-21716","evidence":"CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown (CVE-2026-21716)"}],"security_relevant":true,"severity_evidence":"2 high severity issues."},"group_id":"advisory:ed18e8b9-148d-46af-aa8f-16ccebeea63a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","advisory_id":"ed18e8b9-148d-46af-aa8f-16ccebeea63a","event_types":["patch"],"published_at":"2026-10-25T03:57:28.996522+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T03:00:00+00:00","detail_url":"/events/19342"}]}},{"id":19477,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 22.22.2 (LTS)","summary":"Node.js 22.22.2 is a security release addressing multiple vulnerabilities, with fixes listed as High, Medium, and Low.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 22.22.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"22.22.2","evidence":"Version 22.22.2 'Jod' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) - Medium"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:663acf7f-0966-4334-86bb-abda86423d0f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v22.22.2","advisory_id":"663acf7f-0966-4334-86bb-abda86423d0f","event_types":["patch"],"published_at":"2026-10-25T03:56:22.40381+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:26+00:00","detail_url":"/advisories/advisory%3A663acf7f-0966-4334-86bb-abda86423d0f","group":{"id":"advisory:663acf7f-0966-4334-86bb-abda86423d0f","revision":1,"primary_event_id":19341,"change":"published","superseded_by":[],"changed":{"id":19341,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 22.22.2 (LTS)","summary":"Node.js 22.22.2 is a security release addressing multiple vulnerabilities, with fixes listed as High, Medium, and Low.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 22.22.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"22.22.2","evidence":"Version 22.22.2 'Jod' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) - Medium"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:663acf7f-0966-4334-86bb-abda86423d0f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v22.22.2","advisory_id":"663acf7f-0966-4334-86bb-abda86423d0f","event_types":["patch"],"published_at":"2026-10-25T03:56:22.40381+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:26+00:00","detail_url":"/events/19341"},"members":[{"id":19341,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 22.22.2 (LTS)","summary":"Node.js 22.22.2 is a security release addressing multiple vulnerabilities, with fixes listed as High, Medium, and Low.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 22.22.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"22.22.2","evidence":"Version 22.22.2 'Jod' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) - Medium"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:663acf7f-0966-4334-86bb-abda86423d0f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v22.22.2","advisory_id":"663acf7f-0966-4334-86bb-abda86423d0f","event_types":["patch"],"published_at":"2026-10-25T03:56:22.40381+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:26+00:00","detail_url":"/events/19341"}]}},{"id":19476,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 24.14.1 (LTS)","summary":"Node.js 24.14.1 is a security release that addresses multiple security issues.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 24.14.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"24.14.1","evidence":"Node.js 24.14.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) wrap SNICallback invocation in try/catch"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717) test array index hash collision"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code"},{"value":"CVE-2026-21712","evidence":"(CVE-2026-21712) handle url crash on different url formats"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716) include permission check on lib/fs/promises"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715) add permission check to realpath.native"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b310d021-e89c-4c2b-9e5b-0e8ff75f8fa8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v24.14.1","advisory_id":"b310d021-e89c-4c2b-9e5b-0e8ff75f8fa8","event_types":["patch"],"published_at":"2026-10-25T03:55:22.84483+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:31+00:00","detail_url":"/advisories/advisory%3Ab310d021-e89c-4c2b-9e5b-0e8ff75f8fa8","group":{"id":"advisory:b310d021-e89c-4c2b-9e5b-0e8ff75f8fa8","revision":1,"primary_event_id":19340,"change":"published","superseded_by":[],"changed":{"id":19340,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 24.14.1 (LTS)","summary":"Node.js 24.14.1 is a security release that addresses multiple security issues.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 24.14.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"24.14.1","evidence":"Node.js 24.14.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) wrap SNICallback invocation in try/catch"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717) test array index hash collision"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code"},{"value":"CVE-2026-21712","evidence":"(CVE-2026-21712) handle url crash on different url formats"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716) include permission check on lib/fs/promises"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715) add permission check to realpath.native"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b310d021-e89c-4c2b-9e5b-0e8ff75f8fa8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v24.14.1","advisory_id":"b310d021-e89c-4c2b-9e5b-0e8ff75f8fa8","event_types":["patch"],"published_at":"2026-10-25T03:55:22.84483+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:31+00:00","detail_url":"/events/19340"},"members":[{"id":19340,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 24.14.1 (LTS)","summary":"Node.js 24.14.1 is a security release that addresses multiple security issues.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 24.14.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"24.14.1","evidence":"Node.js 24.14.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) wrap SNICallback invocation in try/catch"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717) test array index hash collision"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code"},{"value":"CVE-2026-21712","evidence":"(CVE-2026-21712) handle url crash on different url formats"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716) include permission check on lib/fs/promises"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715) add permission check to realpath.native"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b310d021-e89c-4c2b-9e5b-0e8ff75f8fa8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v24.14.1","advisory_id":"b310d021-e89c-4c2b-9e5b-0e8ff75f8fa8","event_types":["patch"],"published_at":"2026-10-25T03:55:22.84483+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:31+00:00","detail_url":"/events/19340"}]}},{"id":19475,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 20.20.2 (LTS)","summary":"Node.js 20.20.2 is a security release fixing multiple issues, including array index hash collision, timing-safe comparison, permission checks, and TLS callback handling.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.20.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.20.2","evidence":"Version 20.20.2 'Iron' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717) fix array index hash collision"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716) include permission check on lib/fs/promises"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715) add permission check to realpath.native"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) wrap SNICallback invocation in try/catch"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:457b022c-68b2-453d-8b2a-fdd41b27b76a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.20.2","advisory_id":"457b022c-68b2-453d-8b2a-fdd41b27b76a","event_types":["patch"],"published_at":"2026-10-25T03:54:22.366538+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:35:47+00:00","detail_url":"/advisories/advisory%3A457b022c-68b2-453d-8b2a-fdd41b27b76a","group":{"id":"advisory:457b022c-68b2-453d-8b2a-fdd41b27b76a","revision":1,"primary_event_id":19339,"change":"published","superseded_by":[],"changed":{"id":19339,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 20.20.2 (LTS)","summary":"Node.js 20.20.2 is a security release fixing multiple issues, including array index hash collision, timing-safe comparison, permission checks, and TLS callback handling.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.20.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.20.2","evidence":"Version 20.20.2 'Iron' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717) fix array index hash collision"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716) include permission check on lib/fs/promises"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715) add permission check to realpath.native"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) wrap SNICallback invocation in try/catch"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:457b022c-68b2-453d-8b2a-fdd41b27b76a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.20.2","advisory_id":"457b022c-68b2-453d-8b2a-fdd41b27b76a","event_types":["patch"],"published_at":"2026-10-25T03:54:22.366538+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:35:47+00:00","detail_url":"/events/19339"},"members":[{"id":19339,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 20.20.2 (LTS)","summary":"Node.js 20.20.2 is a security release fixing multiple issues, including array index hash collision, timing-safe comparison, permission checks, and TLS callback handling.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.20.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.20.2","evidence":"Version 20.20.2 'Iron' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717) fix array index hash collision"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716) include permission check on lib/fs/promises"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715) add permission check to realpath.native"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) wrap SNICallback invocation in try/catch"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:457b022c-68b2-453d-8b2a-fdd41b27b76a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.20.2","advisory_id":"457b022c-68b2-453d-8b2a-fdd41b27b76a","event_types":["patch"],"published_at":"2026-10-25T03:54:22.366538+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:35:47+00:00","detail_url":"/events/19339"}]}},{"id":19474,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 25.8.2 (Current)","summary":"Node.js 25.8.2 is a security release addressing multiple CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 25.8.2 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"25.8.2","evidence":"Version 25.8.2 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637)"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710)"},{"value":"CVE-2026-21711","evidence":"(CVE-2026-21711)"},{"value":"CVE-2026-21712","evidence":"(CVE-2026-21712)"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713)"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714)"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715)"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716)"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:efc76334-94e6-45d6-a27d-f4816d1a32a8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v25.8.2","advisory_id":"efc76334-94e6-45d6-a27d-f4816d1a32a8","event_types":["patch"],"published_at":"2026-10-25T03:52:21.858666+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:41+00:00","detail_url":"/advisories/advisory%3Aefc76334-94e6-45d6-a27d-f4816d1a32a8","group":{"id":"advisory:efc76334-94e6-45d6-a27d-f4816d1a32a8","revision":1,"primary_event_id":19338,"change":"published","superseded_by":[],"changed":{"id":19338,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 25.8.2 (Current)","summary":"Node.js 25.8.2 is a security release addressing multiple CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 25.8.2 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"25.8.2","evidence":"Version 25.8.2 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637)"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710)"},{"value":"CVE-2026-21711","evidence":"(CVE-2026-21711)"},{"value":"CVE-2026-21712","evidence":"(CVE-2026-21712)"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713)"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714)"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715)"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716)"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:efc76334-94e6-45d6-a27d-f4816d1a32a8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v25.8.2","advisory_id":"efc76334-94e6-45d6-a27d-f4816d1a32a8","event_types":["patch"],"published_at":"2026-10-25T03:52:21.858666+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:41+00:00","detail_url":"/events/19338"},"members":[{"id":19338,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 25.8.2 (Current)","summary":"Node.js 25.8.2 is a security release addressing multiple CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 25.8.2 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"25.8.2","evidence":"Version 25.8.2 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637)"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710)"},{"value":"CVE-2026-21711","evidence":"(CVE-2026-21711)"},{"value":"CVE-2026-21712","evidence":"(CVE-2026-21712)"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713)"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714)"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715)"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716)"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:efc76334-94e6-45d6-a27d-f4816d1a32a8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v25.8.2","advisory_id":"efc76334-94e6-45d6-a27d-f4816d1a32a8","event_types":["patch"],"published_at":"2026-10-25T03:52:21.858666+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:41+00:00","detail_url":"/events/19338"}]}}],"next_after":19478,"next_before":19474}